T1016Discovery
System Network Configuration Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route. Adversaries may also leverage a Network Device…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
12 Sigma rules tagged T1016System Network Configuration DiscoveryT101612 general rules
- OpenCanary - SNMP OID Requesthightest
- Potential Pikabot Discovery Activityhightest
- Potential Recon Activity Via Nltest.EXEmediumtest
- Suspicious Network Connection to IP Lookup Service APIsmediumtest
- Cisco Discoverylowtest
- Firewall Configuration Discovery Via Netsh.EXElowtest
- Local Firewall Rules Enumeration Via NetFirewallRule Cmdletlowtest
- Nltest.EXE Executionlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to System Network Configuration Discovery
1 CVE, by priority. Each link shows its badge.- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 moreMITRE CTID mapping of the KEV entry · follow-on activity81.9%Top 0.35%78.4priority